IN THE CLAIMS 



This listing of claims will replace all prior versions, and listings, of claims in the 
application: 
Listing of Claims: 

1 . (Original) A network security apparatus comprising: 

a billing server configured to calculate security protection consumption during a period of 
time by quantifying damages avoided by one or more blocked attacks. 

2. (Original) The apparatus of claim 1, wherein calculating security protection consumption 
further includes determining whether a blocked attack would have exploited a network 
vulnerability. 

3. (Currently amended) The apparatus of claim 2, wherein d e termination determining [[if]] 
whether a blocked attack would have exploited network vulnerability i nclude s det e rmined by 
replaying the attack on [[the]] an internal network. 

4. (Original) The apparatus of claim 1, further comprising a scanner configured to scan one or 
more devices for vulnerabilities. 

5. (Original) The apparatus of claim 4, wherein the scanner is configured to quantify the risk of 
one or more devices. 

6. (Original) The apparatus of claim 4, wherein the scanner is located within a customer 
network. 

7. (Original) The apparatus of clam 1, further comprising an intrusion suppression module 
configured to block attacks. 

8. (Original) The apparatus of claim 7, wherein the intrusion suppression module is configured 
to maintain a list of attacks sustained and blocked during a period of time. 
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9. (Original) The apparatus of claim 7, wherein the intrusion suppression module is located 
outside a customer network. 

10. (Currently amended) A network security method comprising compris e d of : 

quantifying damages avoided by one or more blocked attacks; and 
calculating security protection consumption during a period of time. 

1 1 . (Currently amended) The method of claim 10, further comprising compris e d of 
determining whether a blocked attack would have exploited network vulnerability. 

12. (Currently amended) The method of claim 1 0 5 further comprising compris e d of scanning 
one or more devices for vulnerabilities. 

13. (Currently amended) The method of claim 12, further comprising compris e d of 
quantifying the risk of one or more devices. 

14. (Currently amended) The method claim 1, further comprising comprised of th e blocking 
one or more attacks. 

15. (Currently amended) The method of claim 14, further comprising compris e d of th e 
maintaining [[of]] a list of attacks sustained and blocked during a period of time. 

16. (Original) A network se curity apparatus comprised of: 

means for quantifying damages avoided by one or more blocked attacks; and 
means for calculating security protection consumption during a period of time. 

17. (Original) The appa ratus of claim 16, further comprised of the means for determining 
whether a blocked attack would have exploited network vulnerability. 

18. (Original) The appa ratus of claim 16, further comprised of the means for scanning one or 
more devices for vulnerabilities. 
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19. (Original) The appa ratus of claim 18, further comprised of the means for quantifying the risk 
of one or more devices. 

20. (Original) The appa ratus claim 16, further comprised of the means for blocking one or more 
attacks. 

21. (Original) The appa ratus of claim 20, further comprised of the means for maintaining a list 
of attacks sustained and blocked during a period of time. 

22. (Currently amended) A computer program product stor e d on embodied in a tangible 
computer-readable medium, and th e program comprising computer instructions for: 

quantifying damages avoided by one or more blocked attacks; and 
calculating security protection consumption during a period of time. 

23. (Currently amended) The computer program product of claim 21, further comprising 
computer instructions for determining whether a blocked attack would have exploited network 
vulnerability. 

24. (Currently amended) The computer program product of claim 2 1 , further comprising 
computer instructions for scanning one or more devices for vulnerabilities. 

25. (Currently amended) The computer program product of apparatus of claim [[23]] 21_, 
further comprising computer instructions for quantifying risk of one or more devices. 

26. (Currently amended) The computer program product of claim 2 1 , further comprising 
computer instructions blocking one or more attacks. 

27. (Currently amended) The computer program product apparatu s of claim [[25]] 26, 
further comprising computer instructions m e ans for maintaining a list of attacks sustained and 
blocked during a period of time. 
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28. (Cancelled) 
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